System and Methods for Assignation and Use of Media Content Subscription Service Privileges

ABSTRACT

This invention describes a system and methods for media content subscription service distribution; typical services include cable television, premium content channels, pay-per-view, XM radio, and online mp3 services. Subscribers use portable electronic devices to store digital certificates certifying the subscriber&#39;s privileges and an assigned public key. The devices can communicate with specially enabled televisions, radios, computers, or other media presentation apparatuses. These, in turn, can communicate with central databases owned by the provider, for verification purposes. Methods of the invention describe media content subscription service privilege issuing and use. The invention additionally describes methods for protecting media content transmitted to users with a variety of encryption schemes. The invention also comprises methods for subscribed users to bestow a subset of their privileges to a number of secondary users, with appropriate permission from the media content subscription service provider.

RELATED U.S. APPLICATION DATA

This application is a continuation of and claims priority to U.S. patentapplication Ser. No. 10/858,336, filed on Jun. 1, 2004, entitled “Systemand Methods for Assignation and Use of Media Content SubscriptionService Privileges,” which claims priority under USC 119(e) toProvisional Patent Application Ser. No. 60/474,750 entitled, “SecureBiometric Identification Devices and Systems for Various Applications,”both of which are hereby incorporated by reference in their entirety.

BACKGROUND OF THE INVENTION

1. Field of the Invention

This invention relates generally to the field of media contentsubscription services, and more specifically to portable and remotelycontrolled user privileges, and electronic/digital resource and assetmanagement.

2. Necessity of the Invention

Media content subscription services are increasingly popular andprofitable services. Common antenna (CATV), or cable television,subscriptions are found in millions of homes across America, and musicservices such as www.emusic.com and XM Radio are reporting increases inuser levels. Most media content subscription services require anindividual to apply for subscription, and if the media contentsubscription service provider wishes to accept the individual, he/she isprovided with an appropriate service privilege-receiver. In the case ofCATV, an accepted individual typically receives a set-top-box that isuniquely identified and associated with the individual. The set-top-boxis capable of decrypting the CATV signal and supplies the decryptedversion to the individual's television.

However, once activated, these services typically require very littleuser identification, and an authorized user could unknowingly providehis benefits to other people. Most people have heard stories of‘stealing cable from the neighbors’ and other rights-hijacking attempts.Additionally, because these services often expect use of a ‘home base’,such as a television set-top-box or a cookie on a computer, transportingsubscription privileges from one location to another is anything fromdifficult to impossible. For example, it is very difficult for a cablesubscriber to take his cable subscription service privileges to afriend's—and non-subscriber's—house for cable viewing at the friend'shouse.

The necessity for administrative convenience and security hasoverwhelmed the subscriber's flexibility of subscription permissions.There is a definite need for a user-centric subscription service system,allowing for vendor, provider and user security, while allowing forgreater user flexibility.

3. Description of the Related Art

Digital Rights Management Related Art

U.S. Pat. No. 5,715,403 to Stefik discloses a system for controlling useand distribution of digital works. The invention allows the owner of adigital work to attach usage rights to their work. The usage rightsdefine how the individual digital work may be used and distributed.Instances of usage rights are defined using a flexible and extensibleusage rights grammar. Although the patent provides a network terminatingdevice-based internal digital rights management system capability formanaging and monitoring digital properties, the Stefik patent does notprovide a user-oriented system for accessing digital rights andprivileges.

U.S. Pat. Nos. 6,401,085, 6,356,905, and 6,199,099, all to Gershman,disclose a system that facilitates web-based information retrieval anddisplay. A wireless phone or similar hand-held wireless device withinterne protocol capability is combined with other peripherals toprovide a portable portal into the Internet. The wireless device promptsa user to input information of interest to the user. This information istransmitted a query to a service routine running on a Web server. Theservice routine then queries the Web to find price, shipping andavailability information from various Web suppliers. This infoimation isavailable for use by various applications through an interface supportframework. An “electronic valet” capability is also disclosed whichrepresents a convenient mechanism for organizing user preferences,rights, privileges, etc. However, the patent, and the products itprotects, does not provide a user-centric, media content subscriptionservice system.

A variety of other U.S. patents discuss securely or privately accessedsystems, digital rights management systems, and other remotely,wirelessly, or portably accessed or controlled systems or resources,including U.S. Pat. Nos. 6,135,646, 6,256,393, 6,289,445, 6,327,622,6,449,367, 6,499,099, 6,330,770, 6,535,871 and others. None of thesepatents provide a user-centric media content subscription servicesystem.

U.S. Pat. No. 6,516,412 to Wasilewski discloses a CATV system thatprovides conditional access to services. The cable television systemincludes a head-end from which service “instances” are broadcast, andprovides set-top units for receiving the instances and selectivelydecrypting the instances for display to system subscribers. Theseservice instances are encrypted using public and/or private keysprovided by service providers or central authorization agents. Keys usedby the set-top units for selective decryption may also be public orprivate in nature, and such keys may be reassigned at different times toprovide a cable television system in which piracy concerns areminimized. The Wasilewski patent appears not to perceive or articulate aneed for portable, user-centric privileges. The Wasilewski patent issilent, vague, or incomplete on several features, including hierarchiesof access privileges or verification of authenticated user privileges.There is also no mention of users porting their privileges betweendifferent remotely controlled devices and machinery.

Remote Control Related Art

U.S. Pat. No. 4,005,428 to Graham discloses a patent relating to privateremote control communication systems. In Graham's patent, codedmessages, e.g., for use in remote control of equipment, are transmittedand received in a system which purports to preclude unauthorized oraccidental activation of a control associated with the receiving means.This presumed secure communication is accomplished by generating aplurality of carrier frequencies in a predetermined sequence and bymodulating each carrier frequency in accordance with a digital code. Thereceiving means, which is primarily tuned to receive the first carrierin a transmission sequence, detects and decodes the received signals andstores the decoded message. The equipment to be controlled includes areceiver that is retuned to another carrier frequency after each bit ofa coded message is detected, in a system that appears to resemble a“spread spectrum” type of a communications system, insofar as Graham'spatent notes that the equipment is expected to be responsive to theentire received message.

The Graham patent appears to be one of many re-articulations ofspread-spectrum communications systems, which can be fundamentallydifferent, yet generically are well known in the art. Graham isprimarily directed to communications by radio from a base transmitter toa radio-controlled station or to remote radio station equipment, wheremessage privacy and security are important. Graham does not disclosemedia content subscription service applications.

U.S. Pat. No. 4,847,542 to Clark discloses an automatic garage dooroperator with remote load control. The apparatus of the invention is aremote control device comprising a two button portable controller thatfeatures a “secure mode.” In accordance with the normal operation of thesecure mode button, actuation when the garage door is closed toggles theremote controller between either a secure state or a non-secure state.In the secure state, the automatic garage door operator does not movethe door upon receipt of a door signal. To open the door when in thesecure state, the garage door operator must first press the securebutton to enter the non-secure state and then press the door button toopen the door. The secure button has a secondary function when thegarage door is open and the secure state is prohibited. Actuation of thesecure button when the door is open toggles the state of a load remotefrom the automatic garage door operator between an on state and an offstate. This control is achieved via a signal modulated on the electricpower main. Clark is limited to the control of garage doors and otherdoors, and does not anticipate or suggest applications outside of thenarrow focus of the patent.

U.S. Pat. No. 5,473,318 to Martel discloses a car door operator thatpurports to provide enhanced security for controlled vehicle access byemploying transmitters having unique identity codes that are fixed atthe time of manufacture. A receiver includes a nonvolatile read/writeidentity code memory for storing the authorized identity codes. If areceived identity code is found within this memory, then the user isauthorized and the door is opened. Otherwise, the user is not authorizedand entry is refused. A remotely disposed memory controller controls theauthorized identity codes stored in the identity code memory, which ispreferably electrically erasable programmable read only memory (EEPROM).The memory controller is preferably a desktop computer including a database program with the identity of authorized users. The identity code ofa transmitter held by a formerly authorized user can be determined viathe data base program and deleted from the identity code memory withoutrequiring return of the transmitter. “Pass back” is restricted bypreventing additional door accesses for a predetermined time followingeach access. In an alternative embodiment, a two-button transmitterincludes a fixed identity code and a user selectable identity code. Onebutton transmits the selectable identity code to individualizedreceiver/operators also having a user settable identity code.

U.S. Pat. No. 5,721,583 to Harada, discloses an interactive televisionsystem for providing TV and CATV-based entertainment services and otherTV-based services to authorized users, apparently primarily focused onelectronic polling of users. The invention is based on a “central site”apparatus, apparently a high-capacity computer. Terminal devicesbi-directionally communicate with the central computer via a digitallylinked two-way CATV network, to provide video and audio inputs to adisplay apparatus thereto, with each of the terminal apparatuses beingwirelessly controllable by one or more remote control apparatuses.Additionally, using remote controllers, users can request services orparticipate in TV-centric polling, with the TV being the communicationsmedium in conjunction with a digital link to a central site, via atelevision-attached terminal, such as a set-top box. Message data issuedby a remote control apparatus is automatically accompanied by apparatusidentifier information, then read out from a memory of the remotecontrol apparatus for identifying that remote control apparatus, and mayalso be accompanied by personal information concerning a registered userof the remote control apparatus. Onboard user recognition can beimplemented by a plug-in IC card interface section or fingerprintrecognition section, for enabling restriction of each remote controlapparatus to use by only a specific registered user, or to enable only aspecific registered user to access certain services.

Harada's patent does not lend itself to user-centric applications. Inthe Harada product, primary and apparent last resort placement ofapplication intelligence appears centralized. Harada's “terminal” isapparently a set-top controller connected into the TV. However, set-topterminals appear effectively slaved to the central computer. They do notappear to recognize classes of devices allowed to access them.Implicitly, Harada's central computer is managing and authorizing theenabling of his terminal and by extension, the central site iseffectively, (indirectly) managing remote control devices communicatingwith the terminal attached to the TV, all of which are controlled by anddigitally linked to the central site.

The Harada patent does not disclose hierarchies of remote controldevices or user privileges, optional identity credential verificationsubsystem flexibility, and pre-definable security options on a mobile,portable, application-by-application basis. There is also no mention ofauthorized users porting their remote controllers and their associatedprivileges between different remotely controlled devices and machinery.

U.S. Pat. No. 5,900,867 and U.S. Pat. No. 6,396,544, both to Schindler,et al, teach a self-identifying remote control device having atelevision receiver for use in a computer. An entertainment system isdisclosed which has a personal computer as the heart of the system witha large screen VGA quality monitor as the display of choice. Theentertainment system has digital satellite broadcast reception,decompression and display capability with multiple radio frequencyremote control devices that transmit self-identifying signals and thathave power adjustment capabilities. These features are used to providecontext-sensitive groups of keys that are defined to affect onlyselected applications running in a windowing environment. The remotecontrol devices of this invention claim to combine television and VCRcontrols with standard PC computer keyboard controls. A user of theSchindler invention is not subject to strict authentication anddifferent levels of privilege to operate the remote control or theremote-controlled resource. Schindler is utilitarian for its statedapplications and does not completely disclose or suggest use for one ormore authorized users of the remote controller.

U.S. Pat. No. 6,369,693 to Gibson teaches a method of, and system for,transferring secure data. The method of transferring secure data in aremote control system includes a remote controller and a controlledapparatus that is operable in response to commands relayed by the remotecontroller. The controlled apparatus has a receiver for receivingtransmissions from the remote controller. The remote controller has atransmitter, a memory for storing secure data and commands and a keypad.The embedded transmitter is controlled so that in response to a userwishing to transfer secure data to the user apparatus, it transmits thisdata at a power level lower than that which is normally used for sendingother commands. The link between the remote controller user apparatuscan be radio frequency wireless or infrared wireless.

U.S. Pat. No. 6,424,285 to Perdue, et al, discloses a communicationssystem for transmitting and receiving remote control messages in anelectronic remote control system. This communications system uses amessage protocol that is purportedly suited for transmitting RF remotecontrol messages with IR remote control messages in a time multiplexedfashion, wherein the RF remote control messages are transmitted duringthe pause intervals between IR remote control message transmissionintervals. A plurality of data fields begins with a data field forspecifying a destination device address. A security code data fieldallows a specific remote control transmitter to control a specificdestination device. A status field specifies codes associated with themessage. A keycode field carries a message payload. A checksum fieldverifies the transmission integrity of the remote control message. Aremote control message based on the present message protocol may beexpanded to include additional data fields and to expand pre-existingdata fields. While the Purdue patent, and products it protects, appearsutilitarian for applications requiring both RF and infrared datacommunications, there is no mention of using the remote controllerapparatus for media content subscription services.

Russell, in U.S. Pat. Nos. 5,481,265, 5,729,220, 6,201,484, and6,441,770 describes a ‘secure access transceiver.’ The inventionillustrates a hand-held electronic device that incorporates wirelesstechnology with a button-oriented user interface. The device is used toprovide both identification of an individual and a device to a receivingdevice or system.

International Application No. PCT/US00/42323 describes a BiometricPersonal Identification Device (BPID). A BPID is a hand-held electronicdevice that provides multi-factor authentication and allows its enrolledoperator to control the release and dissemination of stored infoiniationsuch as financial accounts, medical records, passwords, personalidentification numbers, and other sensitive data and information. Thedevice has tamper-resistant packaging with form factors ranging fromcredit card size to key fobs. Various embodiments also include abiometric scanner, a liquid crystal display (LCD) and buttons for userinteraction, and a wireless interface for communication with otherelectronic devices. The device has been developed so that thefingerprint cannot be physically or electronically removed ortransmitted from the device, and information cannot be physically orelectronically removed or transmitted from the device unless released bythe operator of the authorizing biometric. All data and processing isperfoiined securely. The BPID can store a variety of data andapplications, though it is primarily intended for point-of-sale or otherfinancial transactions. However, the BPID does not describe means forsecure remote control access.

BRIEF SUMMARY OF THE INVENTION

This invention describes a system and methods for media contentsubscription service distribution; typical services include CATV,premium content channels, pay-per-view, XM radio, and online musicservices. Subscribers use portable electronic devices, such as ahandheld computer or a laptop, to store digital certificates certifyingthe subscriber's privileges and an assigned public key. Thesecertificates are issued and signed by the media content subscriptionservice provider. The devices can communicate with specially enabledtelevisions, radios, computers, or other media presentation apparatuses.These, in turn, can communicate with central databases owned by theprovider, for verification purposes. In some embodiments of theinvention the media presentation apparatus can examine the privilegecertificate; in other embodiments the media presentation apparatusforwards the privilege certificate to the central database forverification.

Methods of the invention describe media content subscription serviceprivilege issuing and use. The invention additionally describes methodsfor protecting media content transmitted to users with a variety ofencryption schemes. The invention also comprises methods for subscribedusers to bestow a subset of their privileges to a number of secondaryusers, with appropriate permission from the media content subscriptionservice provider. The system is designed for portability and security ofissued privileges.

BRIEF DESCRIPTION OF DRAWINGS Master Reference Numeral List

FIG. 1: System

-   -   101 Personal identification device    -   102 Media presentation apparatus    -   103 Media content subscription service database

FIG. 2: Assigning Primary Applicant Privileges

-   -   251 Specify media content subscription service privilege    -   252 Determine if the primary applicant possesses a        public/private key pair    -   253 Assign a public/private key pair to the primary applicant    -   254 Store the public key and the primary applicant's name in a        database    -   255 Find the primary applicant's public key in a database    -   256 Create and store a media content subscription service        privilege certificate

FIG. 3: Using Primary User Privileges

-   -   351 Select a media content subscription service privilege        certificate    -   352 Authenticate the primary user    -   353 Present the media content subscription service privilege        certificate    -   354 Prove ownership of the certificate    -   355 Verify the media content subscription service provider's        digital signature    -   356 Transmit the encrypted media content feed    -   357 Decrypt the encrypted media content feed    -   358 Display the decrypted media content feed

FIG. 4: Assigning Secondary Applicant Privileges

-   -   451 Specify media content subscription service privilege    -   452 Verify primary user possesses media content subscription        service privilege    -   453 Determine if the secondary applicant possesses a        public/private key pair    -   454 Assign a public/private key pair to the secondary applicant    -   455 Store the public key and the secondary applicant's name in a        database    -   456 Find the secondary applicant's public key in a database    -   457 Create a media content subscription service privilege        certificate for the secondary applicant    -   458 Store the secondary applicant's and the primary applicant's        media content subscription service privilege certificate

FIG. 5: Using Secondary User Privileges

-   -   551 Select a media content subscription service privilege        certificate    -   552 Authenticate the secondary user    -   553 Present the secondary user's media content subscription        service privilege certificate    -   554 Prove ownership of the certificate    -   555 Verify the primary user's digital signature    -   556 Present the primary user's media content subscription        service privilege certificate    -   557 Verify the media content subscription service provider's        digital signature    -   558 Transmit the encrypted media content feed    -   559 Decrypt the encrypted media content feed    -   560 Display the decrypted media content feed

DETAILED DESCRIPTION OF THE INVENTION

This invention describes a system for accessing portable media contentsubscription service privileges, and/or other privileged or protectedcontent or resources. Media content subscription services include CATV,premium content cable channels such as Home Box Office® (HBO®) andShowtime®, pay-per-view, online music services such as www.emusic.com,and satellite radio services such as XM and Sirius radio. These servicesare increasingly popular, but do not typically allow for portability ordistribution of services to other qualified users. The inventiondescribed herein addresses both of these issues.

A Portable Media Content Subscription Service System

The system of this invention can be seen in FIG. 1, and comprises atleast one personal identification device 101, a media presentationapparatus 102, and a media content subscription service database 103.The personal identification device 101 is a portable device that iscapable of identifying its user and providing proof of thisidentification, and that is also capable of encryption, decryption, anddigital signature generation. For example, the personal identificationdevice 101 may be a handheld personal digital assistant, such asHewlett-Packard's iPAQ or Palm's Palm Pilot, the biometric personalidentification device described in Russell, Johnson, Petka, and Singer,a laptop computer, or any other comparable device.

The media content subscription service provider establishes the level ofidentification required by the device. User identification is requiredin order to allow user access to a cryptographic key pair. Digitalsignatures generated by this key pair are considered binding to theindividual, so the level of authentication and identification should beadjusted accordingly. Devices that incorporate local biometricauthentication are preferable, given their ability to uniquely identifyusers. However, some services may only require a password, or a PIN.Other systems may wish to use the personal identification device 101 inconjunction with a smart card or a magnetic stripe card.

A media presentation apparatus 102 is a unit that is capable ofpresenting media content to a user that is adapted for communicatingwith a personal identification device 101 and possibly a remote database103. This may be a television, computer, radio, stereo, or othercomparable device. In preferred embodiments, the media presentationapparatus 102 is also capable of performing encryption, decryption, andverification of digital signatures. This may require addition of a“set-top-box,” or other peripheral, capable of performing thesecryptographic processes.

The media content subscription service database 103 is used to associateusers with assigned cryptographic keys, and required billinginformation. The distribution of cryptographic keys is described infurther detail below.

Applying for and Assigning Media Content Subscription Service Privileges

Individuals must apply to media content subscription service providersfor privileges (this individual is referred to as the ‘primaryapplicant’). The application and distribution of privileges can be seenin FIG. 2, steps 251-256. For example, individuals wishing to watch HBOmust request the privilege from their CATV distributor for the premiumcontent channel (step 251). If the distributor decides to authorize theservice, the distributor searches its database—the media contentsubscription service database 103—for the applicant's unique identifier(step 252). For ease of discussion the unique identifier will be theapplicant's name, but this selection has no impact on the scope of theinvention.

If the primary applicant's name is in the database, the distributoraccesses an associated public key (step 255). If not, the distributorassigns a unique and unused public/private key pair to the applicant andstores the public key in the distributor's database with the applicant'sname (step 253). The distributor now creates a primary media contentsubscription service privilege certificate for the applicant, includingthe HBO privilege, the public key (either the stored key or the newlygenerated key), and a digital signature signed by the distributor (step254). The certificate may also store a secret, shared symmetric key thatcan be used by the applicant's television to decrypt the HBO feed. Thiskey will be described in further detail below.

The primary media content subscription service privilege certificate isdownloaded to the primary applicant's personal identification device 101upon completion (step 256). The individual can now present thecertificate to access HBO at any location with a television and a cableconnection. The individual may also bestow a subset of his privileges toa secondary applicant. This process is also described in further detailbelow.

Although this example describes the use of HBO premium content, thisprocess can be used for subscription to online video or music streams,or any of the other media content subscription services described aboveor known in the art.

Primary User Use of Media Content Subscription Service Privileges

A user authentication process is performed in a manner supportive of theindividual's right to privacy, in accord with the application accessedand the stipulations of the remote-controlled resource or applicationowner, if any. In one embodiment, a tamper-resistant memory within theremote control apparatus stores a pre-enrolled biometric template of theauthorized individual. The template is never authorized to leave thedevice, and is “zeroed-out” upon unauthorized attempted physical orlogical access. When an individual wishes to access controlledresources, he/she submits another biometric template through a reader onthe device. If the submitted identity credential matches the templatestored therein, the user is granted access to operate the remotecontroller and the machinery it controls.

In one embodiment, the remote controlled apparatus includes is atransmitter adapted for generating and transmitting a basic,“standalone,” simplex, one-way “identity credential verification signal”transmission from a user's remote controlled device to a target deviceafter successful initial user authentication. In this embodiment, theremote control apparatus performs the user authentication process,displays the results in the form of a user “identity credentialverification display,” generates and transmits as appropriate, a user“identity credential verification signal” and also transmits usercontrol signals to the remotely controlled device.

Upon receipt of media content subscription service privileges, anindividual may use the personal identification device 101 to use theprivileges. This discussion uses the previous example, in which aprimary applicant (now, the ‘primary user’) receives HBO privileges, andcan be seen in FIG. 3, steps 351-358; again, however, this descriptioncan be expanded to cover any of the discussed services. In this example,the primary user wishes to watch a movie showing on HBO with a friend,at the friend's house. He arrives at his friend's house and selects theHBO privilege on his personal identification device (step 351). Thedevice prompts the individual to authenticate himself (step 352), andupon authentication presents the primary media content subscriptionservice privilege certificate to the television (step 353).

In one embodiment of the invention, the television forwards thecertificate to the cable distributor. Note that the television must beenabled to send and receive messages, as well as perform encryption anddecryption, as described above. This may necessitate a peripheral devicethat can be attached to the television to perform this task, such as aspecial set-top-box, or a “futurized” television that incorporates thecapability. For purposes of further discussion, the television isassumed to have this capability. The cable distributor sends back aresponse to the personal identification device via the television,prompting the primary user to prove ownership of the private keycorresponding to the public key in the certificate (step 354). This istypically accomplished by sending a string to the personalidentification device, encrypting the string with the private key,transmitting the encrypted data back to the distributor, decrypting themessage with the public key, and verifying that the decrypted messagematches the original string. The cable distributor now verifies that itsigned the certificate (step 355). If the cable distributor has alreadyassigned a symmetric private key in the individual's certificate, ituses this key to encrypt the HBO feed, and transmits the encrypted feedto the television (step 356). The television saves the symmetric key anduses it to decrypt the feed (step 357), and presents HBO to theindividual (step 358).

In a second embodiment of the invention, the television has beenpre-programmed with the public key of the cable distributor. Afterreceiving the primary media content subscription service privilegecertificate, the television challenges the personal identificationdevice to ensure that it has ownership of the private key (step 354),and is able to verify that the cable distributor signed the certificatewithout further communication with the distributor (step 355). Again, ifthe distributor has already included a symmetric key in the certificate,the television can use it to decrypt the HBO feed (step 357).

Depending on the embodiment of the invention and the nature of the mediacontent subscription service provider, the provider may choose to use toissue the symmetric secret key in one of several ways. In a firstmethod, the cable distributor may wish to use the same symmetric key forall authorized users of a service, and issue this as part of the primarymedia content subscription service privilege certificate. In a similarmethod, the cable distributor may wish to use the same symmetric key forall authorized users, but update the symmetric key on a daily, weekly,monthly, random, or other time interval basis. This could be used tomake it more difficult for non-subscribers to access the secretsymmetric key. Alternatively, each individual may be assigned a uniquesymmetric secure key. This may be stored in the primary media contentsubscription service privilege certificate or may be changed andprovided each time the individual attempts to access the privilege.

Assigning Media Content Subscription Service Privileges to a SecondaryApplicant

A recipient of media content subscription service privileges may wish toallow other persons to use his privileges. For example, a father who hasinitially applied for and received privileges for HBO (the primary user)may wish to allow his teenage son (the secondary user) to subsequentlywatch the channel in his absence. The father may want to restrict theson's access to movies airing on HBO with a certain MPAA rating, or maywish to restrict the son's access to HBO at certain times. However, itmay be necessary to impose a limit on the number of allowable secondaryusers per primary media content subscription service privilegecertificate—for example, a cable distributor probably does not want aprimary user to bestow his rights upon an entire neighborhood.Accordingly, the media content subscription service provider mayestablish a governing system that states a primary user can only issue acertain number of secondary certificates. This is left to the discretionof the media content subscription service provider.

The distribution process can be seen in FIG. 4, steps 451-458. Thefather instructs his personal identification device to create asecondary media content subscription service privilege certificate forhis son, who is now the ‘secondary user’, and to incorporate anyadditional restrictions that he has selected, such as the MPAA ratings.This step determines the rights appropriate for the son (step 451). Thedevice verifies that the father is only assigning a subset of hisprivileges to the son (step 452). The father now needs a public key forthe son (step 453). If the father has issued a certificate to the sonbefore, he may already have a public key for the son on file in hispersonal identification device or other storage location that he canretrieve and use accordingly (step 456). If not, a public/private keypair is created for the son and the father stores the public key in alocal database (step 454). This database may reside anywhere that theprimary user wishes to keep it.

The father then creates and signs the secondary certificate using his(the father's) private key, and provides it to the son (step 457). Healso provides the primary media content subscription service privilegecertificate to the son (step 458). These certificates may be stored inthe son's personal identification device, or may be stored as part ofthe son's user account in the father's personal identification device.

Secondary User Use of Media Content Subscription Service Privileges

In the example described above, a father elects to bestow his HBOprivileges on his son. Once the son has received his secondarycertificate he is free to make use of the privileges as stipulated byhis father. This process is seen in FIG. 5, steps 551-560. If the sonwishes to watch HBO, he selects the secondary certificate on hispersonal authentication device (step 551). He is prompted toauthenticate, in order to prove that he is authorized to use thecertificate (step 552). The son then presents the secondary certificate;depending on implementation of the system, the son's personalidentification device may perform analysis of this certificate (step553). Alternatively, the secondary certificate could be transmitted tothe television or even to the cable provider as described above. The sonproves ownership of the private key corresponding to the public key inhis certificate (step 554), and the recipient verifies the digitalsignature signed by the primary user, the father (step 555).

The son then presents the primary certificate (issued to his father)(step 556), and the recipient verifies that the cable provider signedthe certificate (step 557). The two certificates together demonstratethe son's ability to use the HBO service; without both, the son cannotaccess the channel. As described in the system above, the cable providerdistributes a symmetric key that is used to encrypt and decrypt the HBOfeed. This key is provided in the same manner as for the primary user.The distributor sends the encrypted HBO feed to the son's television(step 558), and the feed is decrypted and displayed (step 559 and 560).

While the description above refers to particular embodiments of thepresent invention, it will be understood that many modifications may bemade without departing from the spirit thereof. The accompanying claimsare intended to cover such modifications as would fall within the truescope and spirit of the present invention.

1. A method, comprising: receiving, at a media device, a firstcertificate associated with a first user from a personal identificationdevice after the first user is biometrically-authenticated at thepersonal identification device, the first certificate having asubscription privilege associated with the first user; receiving, at themedia device, a second certificate from the personal identificationdevice after the first user is biometrically-authenticated at thepersonal identification device, the second certificate being associatedwith a second user and having a plurality of subscription privilegesincluding the subscription privilege, the first certificate being basedon the second certificate; and receiving, at the media device, mediafrom a media provider based on the first certificate after the secondcertificate is received at the media device and the first certificate isverified, the media provider preventing the media associated with thefirst certificate from being sent to the media device until the secondcertificate is received at the media device and the first certificate isverified.
 2. The method of claim 1, further comprising: verifying, atthe media device, an authenticity of the first certificate received fromthe personal identification device.
 3. The method of claim 1, whereinthe personal identification device is a first personal identificationdevice associated with the first user, the method further comprising:receiving, at the media device, the second certificate from a secondpersonal identification device associated with the second user after thesecond user is biometrically-authenticated at the second personalidentification device; and receiving, at the media device, media fromthe media provider based on the second certificate after the secondcertificate is received at the media device, the media providerpreventing the media associated with the second certificate from beingsent to the media device until the second certificate is received at themedia device.
 4. The method of claim 1, further comprising: allowing, atthe media device, output of the media associated with the firstcertificate received from a media provider, the media device beingpre-registered with a subscription service of the media provider.
 5. Themethod of claim 1, wherein the media device is associated with a thirduser, the media device being pre-registered with a subscription serviceof the media provider, the subscription service not including thesubscription privilege of the first certificate.
 6. The method of claim1, further comprising: verifying, at the media device, an authenticityof the second certificate received from the personal identificationdevice, the media associated with the first certificate from the mediaprovider is received at the media device after the first certificate andthe second certificate is verified.
 7. The method of claim 1, furthercomprising: sending a string from the media device to the personalidentification device such that the personal identification deviceencrypts the string using a private key uniquely associated with thefirst certificate and sends the encrypted string to the media device;and decrypting, at the media device, the encrypted string to verify anauthenticity of the first certificate when the decrypted string matchesthe string.
 8. The method of claim 1, wherein the receiving the mediaincludes receiving an encrypted media from the media provider, the mediadevice storing a symmetric key uniquely associated with the firstcertificate and the media provider, the media device configured to usethe symmetric key to decrypt the received encrypted media, the mediadevice configured to output the decrypted media.
 9. The method of claim1, wherein the second user is a primary user of a subscription serviceof the media provider and the first user is a secondary user of thesubscription service.
 10. The method of claim 1, wherein the receivingthe first certificate occurs substantially concurrently with thereceiving the second certificate.
 11. The method of claim 1, wherein thereceiving the first certificate includes receiving the first certificatewithout receiving biometric information associated with the first user,the media device not storing any biometric information associated withthe first user.
 12. The method of claim 1, wherein the subscriptionprivilege of the first certificate is uniquely associated with a mediachannel.
 13. The method of claim 1, wherein the personal identificationdevice is in a first housing at a first location and the media device isin a second housing different from the first housing at the firstlocation, the media provider is at a second location different from thefirst location.
 14. A processor-readable medium storing coderepresenting instructions to cause a processor to perform a process, thecode comprising code to: authenticate, at a first personalidentification device, a biometric input of a first user based on abiometric template of the first user stored at the first personalidentification device, the first personal identification device storinga first certificate having a plurality of subscription privilegesassociated with the first user; generate, at the first personalidentification device, a second certificate associated with a seconduser based on the first certificate, the second certificate having atleast one subscription privilege from the plurality of subscriptionprivileges associated with the first user; and send the firstcertificate and the second certificate from the first personalidentification device to a second personal identification deviceassociated with the second user such that the second user is permittedto access media associated with the at least one subscription privilegeof the second certificate from a media provider based on the firstcertificate and the second certificate.
 15. The processor-readablemedium of claim 14, the code further comprising code to: store thesecond certificate at the first personal identification device.
 16. Theprocessor-readable medium of claim 14, the code further comprising codeto: receive, at the first personal identification device from the firstuser, a selection of the at least one subscription privilege from theplurality of subscription privileges associated with the first user forthe second certificate before the second certificate is generated. 17.The processor-readable medium of claim 14, wherein the first certificateexcludes biometric information of the first user.
 18. Theprocessor-readable medium of claim 14, wherein the first personalidentification device does not store any biometric informationassociated with the second user.
 19. The processor-readable medium ofclaim 14, the code further comprising code to: generate, at the firstpersonal identification device, a private key uniquely associated withthe second user, the private key being stored at the first personalidentification device.
 20. A processor-readable medium storing coderepresenting instructions to cause a processor to perform a process, thecode comprising code to: authenticate, at a personal identificationdevice at a first location, a biometric input of a first user based on abiometric template of the first user stored at the personalidentification device; send a first subscription privilege associatedwith the first user from the personal identification device to a firstmedia device at the first location when the biometric input of the firstuser is authentic such that the first media device outputs mediaassociated with the first subscription privilege from a media provideronly after receiving the first subscription privilege from the personalidentification device; authenticate, at the personal identificationdevice at a second location, a biometric input of a second user based ona biometric template of the second user stored at the personalidentification device; and send a second subscription privilegeassociated with the second user from the personal identification deviceto a second media device at the second location when the biometric inputof the second user is authentic such that the second media deviceoutputs media associated with the second subscription privilege from themedia provider only after receiving the second subscription privilegefrom the personal identification device.
 21. The processor-readablemedium of claim 20, the code further comprising code to: send the firstsubscription privilege from the personal identification device to thesecond media device at the second location when the biometric input ofthe second user is authentic such that the second media device outputsmedia associated with the second subscription privilege from the mediaprovider only after receiving the first subscription privilege and thesecond subscription privilege from the personal identification device.22. The processor-readable medium of claim 20, wherein the first mediadevice is associated with a subscription of the first user and thesecond media device is associated with a subscription of a third user.23. The processor-readable medium of claim 20, wherein the first user isa primary user of a subscription service of the media provider and thesecond user is a secondary user of the subscription service.
 24. Theprocessor-readable medium of claim 20, wherein the first subscriptionprivilege is configured to permit full access to the media from themedia provider associated with the first subscription privilege.
 25. Theprocessor-readable medium of claim 20, wherein the second subscriptionprivilege is configured to permit limited access to the media associatedwith the first subscription privilege from the media provider.